1. Identity Theft FBI Norfolk (757) 455-0100 SA Mark T. Park

2. Cyber Unit Computer based Crimes Computer based Crimes Forensic analysis Forensic analysis Internet Scams Internet Scams Other crimes with a cyber nexus Other crimes with a cyber nexus Child Pornography Child Pornography Cyber is high on the national and regional priority lists Cyber is high on the national and regional priority lists

3. Introduction Video

4. IDENTITY THEFT Definition Definition Why and How Why and How Tools and Methods Tools and Methods Minimizing Your Risk Minimizing Your Risk Indications of ID Theft Indications of ID Theft What to do if Victimized What to do if Victimized

5. What is Identity Theft? Someone uses bits and pieces of information about a person. (ex: SSN) Someone uses bits and pieces of information about a person. (ex: SSN) Represents him or herself as that person for fraudulent purposes. (ex: Obtaining credit cards or loans, getting a cell phone, etc.) Represents him or herself as that person for fraudulent purposes. (ex: Obtaining credit cards or loans, getting a cell phone, etc.) Worse case, someone commits a crime in the victim’s name. (ex: Internet fraud) Worse case, someone commits a crime in the victim’s name. (ex: Internet fraud)

6. Who is at Risk ? EVERYONE (including children and the deceased) EVERYONE (including children and the deceased) Over 6 million people victimized every year Over 6 million people victimized every year Trans Union receives over 2,000 fraud reports a day Trans Union receives over 2,000 fraud reports a day

7. AT WHAT COST? Approximately $6000 Mean Loss Per Victim Approximately $6000 Mean Loss Per Victim 600 Hours to Recover 600 Hours to Recover Estimated annual loss of $53 Billion in U.S. for Businesses and Consumers. Estimated annual loss of $53 Billion in U.S. for Businesses and Consumers. Number of victims and total losses are probably much higher because not all agencies classify certain crimes as ID Theft. Number of victims and total losses are probably much higher because not all agencies classify certain crimes as ID Theft.

8. Federal Legislation Identity Theft and Assumption Deterrence Act (18 USC 1028) Identity Theft and Assumption Deterrence Act (18 USC 1028) –1028(a)(7) “conventional ID Theft” This section makes it a crime to knowingly transfer, possess, or use without lawful authority a means of identification of another person with the intent to commit unlawful activity. Makes Identity theft a felony. Penalty of 5 years enhancements allowable (phishing, terrorism) Makes Identity theft a felony. Penalty of 5 years enhancements allowable (phishing, terrorism) Allows for victim restitution. Victims are not liable for bills accumulated by the imposters Allows for victim restitution. Victims are not liable for bills accumulated by the imposters

9. Why is it so prevalent ? Social Security numbers are commonly used as ID (often when not required) Social Security numbers are commonly used as ID (often when not required) Criminals can steal mail Criminals can steal mail Dishonest employees can obtain credit card information and victim’s information Dishonest employees can obtain credit card information and victim’s information Internet is a great source of information Internet is a great source of information Simple method – stealing someone’s wallet Simple method – stealing someone’s wallet

10. How do thieves use stolen identities? To commit financial fraud: To commit financial fraud: Phone/Utilities fraud (18%) Bank Fraud (17%) Employment Related Fraud (14%) Credit card fraud (26%) Credit card fraud (26%) Loan Fraud (5%) Concealment of Criminal Identity/Record Concealment of Criminal Identity/Record Restart with a “ Clean Slate ” Terrorism Terrorism

11. METHODS: SKIMMING Where a thief temporarily steals a credit card and runs it through a “skimmer” which is a credit card reader to steal information off of the card. Where a thief temporarily steals a credit card and runs it through a “skimmer” which is a credit card reader to steal information off of the card.

12. MAGNETIC STRIPE READERS & CARD PRINTERS

13. This ATM looks normal …

14. Look closer…a skimmer was placed in front of the card reader

15. Anything “look” amiss here?

16. Hidden camera to Record your PIN Entry

17. The Internet as a Tool Identities could be easily purchased online Identities could be easily purchased online You can purchase a fake drivers license You can purchase a fake drivers license Identities are frequently bought and sold in bulk on the Internet by criminals at an average cost of $14 to $18 for each stolen identity Identities are frequently bought and sold in bulk on the Internet by criminals at an average cost of $14 to $18 for each stolen identity

19. Phishing

20. Phishing Defined Phishing is the term coined by hackers who imitate legitimate companies in e-mails and fake websites to trick people in to sharing personal information. Phishing is the term coined by hackers who imitate legitimate companies in e-mails and fake websites to trick people in to sharing personal information. Victims include AOL, Best Buy, eBay and the Federal Trade Commission. Victims include AOL, Best Buy, eBay and the Federal Trade Commission. As of May 2007 there were over 37,000 fake web sites As of May 2007 there were over 37,000 fake web sites

21. Phishing Derivatives Spear Phishing - Uses More Targeted Information Against Specific Group Spear Phishing - Uses More Targeted Information Against Specific Group Vishing – Prompt by Email to Call Toll Free Number to “Verify” Personal Information Vishing – Prompt by Email to Call Toll Free Number to “Verify” Personal Information Whaling – targets top level executives. Whaling – targets top level executives.

22. How “Phishing” Works The typical phishing scam usually starts with an e-mail message. (ex: work from home, post your résumé, Viagra) The typical phishing scam usually starts with an e-mail message. (ex: work from home, post your résumé, Viagra) The e-mail directs the victim to a fake web page, sometimes containing false e-mail addresses, fictitious web addresses, malware. The e-mail directs the victim to a fake web page, sometimes containing false e-mail addresses, fictitious web addresses, malware. The “Lure” often contains a place for the victim to enter personal data. The “Lure” often contains a place for the victim to enter personal data. Sometimes the scam opens the real web page, but uses a fake pop-up screen. Sometimes the scam opens the real web page, but uses a fake pop-up screen.

23. Earthlink

24. Citibank

25. Paypal

26. Paypal

27. AOL

28. E-Bay

29. CVV Phishing Scheme CVV Code (3 Digits) on the Back of Credit Cards CVV Code (3 Digits) on the Back of Credit Cards Call from Person Claiming to be with your Credit Card Company Call from Person Claiming to be with your Credit Card Company Already have Card Number Already have Card Number Sound Official, and Only ask for CVV code Sound Official, and Only ask for CVV code

30. ADDITIONAL TRICKS USED BY THIEVES Dumpster Diving Dumpster Diving Mail Theft Mail Theft Shoulder Surfing Shoulder Surfing Social Engineering Social Engineering IRS IRS Service of Court documents Service of Court documents Credit Card companies Credit Card companies

31. Minimize Your Risk Use secure mailbox for outgoing mail Use secure mailbox for outgoing mail Shred trash Shred trash Cancel lost/stolen cards ASAP. Cancel lost/stolen cards ASAP. Use credit cards, not debit cards online Use credit cards, not debit cards online Check your credit at least once a year Check your credit at least once a year Activate computer protections: keep software up to date, install virus and spyware software, and utilize your firewall Activate computer protections: keep software up to date, install virus and spyware software, and utilize your firewall Enable encryption on wireless routers Enable encryption on wireless routers Erase your hard drive when you dispose of your old computer Erase your hard drive when you dispose of your old computer Use “disposable” e-mail to thwart would-be spammers Use “disposable” e-mail to thwart would-be spammers Check web URLs and links carefully Check web URLs and links carefully

32. INDICATIONS OF ID THEFT Unauthorized Charges on your Accounts Unauthorized Charges on your Accounts Credit is denied despite good credit history Credit is denied despite good credit history Contact from creditors regarding debts you did not obtain or authorize Contact from creditors regarding debts you did not obtain or authorize Credit card and bank statements that are not received in the mail as expected Credit card and bank statements that are not received in the mail as expected

33. What should a victim do first ? File a report with local police File a report with local police File a complaint with the Federal Trade Commission File a complaint with the Federal Trade Commission Close accounts that were compromised or opened fraudulently Close accounts that were compromised or opened fraudulently Place a fraud alert on your credit reports and review your credit report Place a fraud alert on your credit reports and review your credit report

34. What’s a Fraud Alert? Legally requires creditors to use “reasonable policies and procedures” to verify your identity before issuing credit in your name. Legally requires creditors to use “reasonable policies and procedures” to verify your identity before issuing credit in your name. There are 2 types of Fraud Alert: There are 2 types of Fraud Alert: - Initial Alert: for 90 days - Extended Alert: for 7 years. Available if you’ve been a victim of identity theft and you provide the consumer reporting company with an Identity Theft Report

35. Online Identity Theft In addition to reporting to local police, file an FTC identity theft complaint at www.ftc.gov/idtheft In addition to reporting to local police, file an FTC identity theft complaint at www.ftc.gov/idtheftwww.ftc.gov/idtheft You can also report online thefts by filing complaint with www.ic3.gov (a joint effort of the FBI and the National White Collar Crime Center) You can also report online thefts by filing complaint with www.ic3.gov (a joint effort of the FBI and the National White Collar Crime Center)www.ic3.gov

36. Identity theft complaints and the FBI The FBI will except complaints from the victim, IC3 or another agency The FBI will except complaints from the victim, IC3 or another agency Generally the FBI handles larger more complex cases with multiple victims and/or large monetary losses Generally the FBI handles larger more complex cases with multiple victims and/or large monetary losses Smaller cases are referred to local agencies. Smaller cases are referred to local agencies.

37. Questions ? www.usdoj.gov www.ftc.gov www.identitytheft.gov